Persistence
To be effective, the attacker must be able to maintain interactive persistence; they must have a two-way communication channel with the exploited system (interactive) that remains on the compromised system for a long period of time without being discovered (persistence). This type of connectivity is a requirement for the following reasons:
- Network intrusions may be detected, and the compromised systems may be identified and patched.
- Some exploits only work once because the vulnerability is intermittent or because exploitation causes the system to fail or change, rendering the vulnerability unusable.
- Attackers may need to return multiple times to the same target for various reasons.
- The target’s usefulness is not always immediately known at the time it is compromised.
The tool used to maintain interactive persistence is usually referred to by classic terms such as backdoor or rootkit. However, the trend toward long-term persistence...
